feat: harden test and registry evidence

tests/e2e/app-shell.spec.js

@@ -1,4 +1,5 @@
-import { expect, test } from "@playwright/test";
+import { expect, test } from "../support/browser/strict-browser-test.js";
+import { successEnvelope } from "../mocks/contracts/envelopes.js";
 import { ROUTE_REGISTRY } from "../../src/features/installed-feature-contracts.js";
 
 test("boots the public app shell", async ({ page }) => {
@@ -32,6 +33,19 @@ test("opens the protected integration route through the local demo seam", async
     (definition) => definition.access === "integration-defined",
   );
   if (!protectedRoute) throw new Error("An integration route is required");
+  await page.route(
+    "http://localhost:8080/api/reference-resources?*",
+    (route) =>
+      route.fulfill({
+        json: successEnvelope([
+          {
+            id: "browser-reference",
+            name: "Browser reference",
+            createdAt: "2026-07-26T00:00:00.000Z",
+          },
+        ]),
+      }),
+  );
   await page.goto(protectedRoute.path);
   await expect(
     page.getByRole("heading", { name: "세션이 필요합니다." }),